Connected: An Internet Encyclopedia
RFC 1510 - 5.5.2. KRB_AP_REP definition

Top: Connected: An Internet Encyclopedia
Up: Requests For Comments
Up: RFC 1510
Up: 5. Message Specifications
Up: 5.5. Client/Server (CS) message specifications
Prev: 5.5.1. KRB_AP_REQ definition
Next: 5.5.3. Error message reply

### 5.5.2. KRB_AP_REP definition

The KRB_AP_REP message contains the Kerberos protocol version number, the message type, and an encrypted timestamp. The message is sent in in response to an application request (KRB_AP_REQ) where the mutual authentication option has been selected in the ap-options field.

       AP-REP ::=         [APPLICATION 15] SEQUENCE {
                  pvno[0]                   INTEGER,
                  msg-type[1]               INTEGER,
                  enc-part[2]               EncryptedData
       }

       EncAPRepPart ::=   [APPLICATION 27]     SEQUENCE {
                  ctime[0]                  KerberosTime,
                  cusec[1]                  INTEGER,
                  subkey[2]                 EncryptionKey OPTIONAL,
                  seq-number[3]             INTEGER OPTIONAL
       }

NOTE: in EncAPRepPart, the application code in the encrypted part of a message provides an additional check that the message was decrypted properly.

The encoded EncAPRepPart is encrypted in the shared session key of the ticket. The optional subkey field can be used in an application-arranged negotiation to choose a per association session key.

pvno and msg-type

  These fields are described above in section 5.4.1. msg-type is KRB_AP_REP.

enc-part

  This field is described above in section 5.4.2.

ctime

  This field contains the current time on the client's host.

cusec

  This field contains the microsecond part of the client's timestamp.

subkey

  This field contains an encryption key which is to be used to protect this specific application session. See section 3.2.6 for specifics on how this field is used to negotiate a key. Unless an application specifies otherwise, if this field is left out, the sub-session key from the authenticator, or if also left out, the session key from the ticket will be used.

Next: 5.5.3. Error message reply

Connected: An Internet Encyclopedia
RFC 1510 - 5.5.2. KRB_AP_REP definition